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Abstract 

a 

A quantum protocol for sharing an arbitrary two-qubit state between N parties is 
introduced. Any of the members, can retrieve the state, only with collaboration of the 
other parties. We will show that in terms of resources, i.e. the number of classical bits, 
the number of Bell pairs shared, and also the type of measurements, our protocol is more 
efficient. For achieving this, we introduce the basic technique of secure passing of an 
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1 Introduction 



The problem of secure sharing of an unknown quantum state between two parties [H, El El HI El E], 
is an important one in quantum cryptography, the branch of quantum information science which 
uses quantum correlations between distant parties for establishing cryptographic keys and split- 
ting and sharing information between different parties ( For recent reviews see [7J El [9] and ref- 
erences therein). The security of all these protocols are based not on mathematical theorems, 
but on the very foundations of quantum mechanical laws, where any attempt of eavesdropping 
can be detected by affecting the quantum correlations between legitimate parties. 

The first protocol for sharing a quantum state between two parties, was suggested in PQ, 
where a GHZ [10] state of the form 

|GffZ) = -^(|000) + |lll», (1) 

is shared between the sender Alice and the receivers Bob and Charlie. For sending an unknown 
qubit state \q) := a|0) + 6(1), Alice makes a Bell measurement on this and his share of the 
GHZ state, obtaining one of the four possible results. She then announces the result of her 
measurement in the form of two classical bits and asks either Bob or Charlie to perform a 
measurement on their share in the X basis and announce their results. The other party who 
has done no measurement can now retrieve the state by a suitable unitary operation. The fact 
that it is Alice who determines who is to receive the final state and who should do measurement 
in the X basis, guarantees the security of the protocol against the cheating of both the receivers. 

While there is straightforward way to generalize this protocol for sharing a qubit to an ar- 
bitrary number of receivers, it is far from obvious how to generalize this protocol in the other 
direction, that is, sending a two-qubit state to two or an arbitrary number of parties. It is 
true that the original scheme of [TJ can be directly generalized for sharing of arbitrary rf-level 
states, simply by generalizing Bell states and Pauli operators in a straightforward way [UJ |12j . 
however such generalization require physical implementation of d— level states or qudits, while 
the mainstream candidates for implementation of quantum information processing are based 
on two-level states or qubits. Therefore it is essential to generalize these and any other protocol 
for quantum information to higher dimensional states which represent not the state of a single 
quantum entity (like a qudit), but that of a few quantum objects (photons, ions,...) or qubits. 

It seems that for increasing the number of receivers or the dimension of the state which is 
to be sent, there is no other way other than using multi-party entangled states, like GHZ states 
and their generalization. For example in [6] a scheme has been proposed for sharing a two-qubit 
state between two parties, where the sender Alice shares two Bell pairs with Bob and Charlie. 
The pattern of Bell state sharing and measurements is shown in figure ([I]). To send the two 
qubit state (shown with red square boxes) to Charlie, she makes two GHZ measurements on 
her shares and the two qubit state which is to be sent and publicly announces the results of 
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these two measurements. Then Bob makes a product measurement o x ® a x on his qubits, and 
publicly announces his result. A direct calculation then shows that Charlie can retrieve the 
original state after performing a suitable unitary operation, determined by the results of public 
bits announced by Alice and Bob. 



Alice 




ie 



Figure 1: The pattern of Bell state sharing and measurements in the protocol of |6j. The light gray 
bulbs indicate Bell pairs and the red square boxes show the two-qubit state which is to be shared. 
The dotted boxes show the GHZ measurements which Alice has to perform and the two qubit product 
measurement by Bob. 

Generalization of this protocol for sending a two-qubit state to N receivers [6], shown in 
figure (j2j), requires 2N Bell pairs and two N— quibt GHZ measurements, which is a formidable 
resource, especially with regard to the GHZ measurements. 




Figure 2: The pattern of Bell state sharing and measurements in the protocol of [6] for N-parties. The 
conventions are the same as in figure (H|). However now Alice has to perform generalized measurements 
of GHZ types. 

In this paper we want to present an alternative scheme for this kind of state sharing which 
uses only Bell states and Bell measurements. The motivation of this work is clear, since con- 
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struction, distribution and maintenance of GHZ states and their generalized N-party states and 
also performing measurements in such bases, are much more difficult than that of two party 
entangled states. In fact many of the experimental obstacles in dealing with pairs of entan- 
gled states has already been removed and it is now well known that experimental realization 
of quantum key distribution [13] [Ej, and quantum teleportation [15] has been achieved over 
increasingly long distances. 

We will show that it is possible to securely share a two-qubit state with an arbitrary number 
of receivers so that only one of the members will be able to retrieve the state with the help of 
the other members. We will first demonstrate this for two receivers and then generalize it to iV 
receivers. For this later part, we introduce a technique which enables the members to pass the 
two-qubit state one by one, among themselves, without any one of them being able to discover 
the identity of the state. The essence of our method is a combination of teleportation and the 
passing technique mentioned above. In addition to alleviating the need for using GHZ states, 
we will also show that our protocol requires much less classical bits to be announced publicly 
by the members. 

For definiteness, we call the final member who is to receive the state, the receiver and the 
other members whose collaboration are necessary for the receiver to reconstruct the state, sim- 
ply as controllers. Like the original scheme of Buzek, Berthiaume and Hillery, the security of 
the protocol against cheating of any subgroup of the members is guaranteed by the fact that it 
is Alice, the sender who decides who is to be the receiver among the members. 

A remark is in order with regard to our method of presentation and reasoning. Usually secret 
sharing schemes, specially between N-parties, require writing many party states with lots of 
indices and following how these states change or collapse under different kinds of measurements 
which even make the notation and the presentation even more clumsy. Instead of this, we 
use a transparent graphical method whose correspondence with the states and their change 
is represented in section (2). After that we will use extensively this correspondence and use 
diagrams to present our reasoning and results in sections (3) and (4). Also we discuses about 
cheating and the number of resources in section (5) and (6). We conclude the paper with a 
discussion. 

2 Two-qubit state sharing between two parties 

Usually secret sharing schemes, specially between N-parties, require writing many party states 
with lots of indices and following how these states change or collapse under different kinds 
of measurements. This makes the presentation cumbersome and difficult to follow. Instead 
of this, we use a transparent graphical method whose correspondence with the states and 
transformations are explained in the following. 
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2.1 Graphical notation 



In this section, we briefly remind the teleportation scheme and set up our graphical conventions. 
The four Bell pairs are denoted by {4>^ u , v — 0, 1} where 

\<f>^):=^=Y,(-ir k \k,k + u)), (2) 

inversion of which yields 

Kn):=^£(-l)H^, m+ n>. (3) 

Let Alice and Bob share a Bell pair of the form \4>n,u) and suppose that Alice wants to teleport 
a qubit (q) in an unknown state \x) = Em °wl m ) to Bob. We designate the qubits in possession 
of Alice and Bob respectively by the subscripts a and b. In figure the Bell pair is shown the 
two gray-colored bulbs joined by a line with a label fi, v and the state is shown by a red-colored 
square box. The total state of (qab) will be in the form 

\y) qab = \x) q \<t>n,v)ab = A= ^(-l) Mfc a m |m, k) qa \k + v) h . (4) 

v 2 m ^ 

Using ([3]) and rearranging terms, we find that this state can be rewritten as 

l*>** = jE(-i)" v l^/) 9 a(r v ^'| x)6 ). (5 ) 

Therefore, the Bell measurement of Alice, performed on the qubits a and q, will project these 
two qubits onto one of the Bell pairs </y„/ and the qubit b of Bob to the state U\x), where 
U = z^'X v+u ' and X and Z are Pauli matrices, Z = |0> <0| - |1}(1| and X = |0)(1| + |1)(0|. 



Alice measurement 



u 



H v 



Figure 3: Teleportation of an unknown qubit \. The reterival operator U = Z^ +tx ' X v+V ' depends on 
the initial Bell pair \iv and the result fx'u' of Alice's measurement, represented by the dashed box. 



Upon public announcement of the result of Alice's measurement, that is the pair of indices 
(//, u'), Bob can recover the state \x) by the action of the operator U. This process is shown in 
figure ([3]), where a Bell pair \4>fj, v ) is shown by two gray circles joined by a line on it with the label 
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[W and the unknown state \x) with a small red square. The rectangular dotted box, indicates 
the measurement of Alice. We will use these conventions in all the subsequent discussions and 
diagram. It is important to note that even if the qubit q is in a mixed state, i.e. if it is part of 
larger pure state, the above diagram is still true. To see this suppose that the qubit q is a part 
of a two partite system qq' whose state can be written as 

l*>=£l*>®l&>. (6) 

i 

Since the teleportation scheme in figure ([3]) does not depend on the state which is to be sent, 
this means that the outcome of the protocol will be given by 

m=j2( u \xi))®\<t>i) = (u ®/)i$>. (7) 

i 

Therefore this basic diagram can be used not only when the qubit is in a pure states, but 
also when it is part of a larger multipartite state. When working with two-qubit states which 
generically are not symmetric, we denote them graphically by an arrow, where the arrow goes 
from the first qubit to the second qubit. We will use this fact extensively in the following 
discussion and diagrams. 

2.2 Sharing of a two-qubit states between two parties 

We can use the teleportation scheme of the last section to show that Alice can share a two-qubit 
state 

with Bob and Charlie so that only one of them can retrieve the information by the collaboration 
of the other. The pattern of Bell pair sharing and order of measurements are shown in figure 
HI Alice shares one pair (a\, b) with Bob and another identical (a.2, c) whit Charlie, who in turn 
share a pair (b', c') between themselves. Without loss of generality, we assume all the EPR pairs 
to be of the form |0oo) := 1 00) = |11). Alice makes two Bell measurements on the qubits in 
her possession, namely (l,ai) and (2,a 2 ). In this way he projects these two qubits onto two 
Bell states, say (j)^ and 4>v,j respectively. From Eq. flS}, the state \x) modified by the operator 

Q = Z^X 1 ® Z u X j 

is transferred to the qubits b and c in possession of Bob and Charlie. This is shown in the first 
part of figure (JH). At this stage the retrieval operator Q is not known to any of them, since Alice 
can defer her public announcement of the result to a later stage. Even if she announces her 
results, neither Bob nor Charlie, can retrieve the whole state, since none of them has access to 
both the qubits. In case that Alice wants Charlie to be the final owner of the two-qubit state, 
she asks Bob to perform a measurement and publicly announces his result. The two qubits will 
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Figure 4: Sharing of a two qubit state between Bob and Charlie by Alice. Alice holds the qubits 
(oi, 02), Bob holds (b, b') and Charlie hods (c, c'). After measurements by Alice and Bob, the states is 
transferred to Charlie, who can recover it by the operator R, only with the collaboration of Alice and 
Bob. 



now be transferred to Charlie who after Alice's public announcement of her results (/i, 1) and 
can completely recover the state |%) by the action of the operator 

R:=(I® Z m X n )(Z»X i ® Z u X j ) cc ,. (9) 

Note that at the end the two Bell pairs will remain between Alice, Bob and Charlie who can 
use them for the next round. 



3 Two-qubit state sharing between N parties 

The method presented above, for splitting a two-qubit state and sending it to two parties, can 
be extended to the general N-party case. The essential point is to distribute the Bell pairs 
between the parties according to a special pattern, shown in figure (jSJ). Each of the of members 
except the first two, holds one share of two Bell pairs, but with two different members. No 
two members of the group share two complete Bell pairs. For example the member B 3 shares 
a Bell pair with B\ and another one with B5. This scheme of Bell pair sharing, as we will 
show, allows all the members to pass a two-qubit state one by one from the beginning of the 
chain to the end, without any member being able to decipher the identity of the state. Here 
we assume that the final member of the group, Bm is the one who is going to recover the state, 
once the other members of the group Bi, B2, ■ ■ ■ B^-i, be. the controllers, collaborate with him 
or her by publicly announcing the results of their measurements. This explains the difference 
of Bell-sharing of him or her with the other members. Also since Alice feeds the unknown state 
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5, B 2 B, 



Figure 5: The pattern of Bell pairs shared between N parties Bi,B2, ....,Bpf. Except the first two 
(Bi, B2) and the last two (B^-i, -Bjv) an Y member Bi shares two Bell pairs with his or her next-nearest 
neighbors. No two members of the group share two complete Bell pairs. Note that all the Bell pairs 
are of the form 0oo- We have not written the labels 00 on them. 

to the left hand side of the chain, that is to B\ and B 2 , they have a different scheme of Bell pair 
sharing. In later subsections we will discuss how Alice can demand that a different member 
acts as the receiver and hence secure the protocol against cheating. But before going into these 
issues, let us first describe the protocol itself which runs as follows. 




Figure 6: Step one: Alice feeds the state \x)i,2 to the controllers Bi and B 2 who will pass their 
share to their next nearest neighbors one by one to the end of the chain. At this stage the state 
\x) can be recovered by the action of the operator Qi = Z %1 X^ ® Z n X^ 2 . 

The scheme consists of three major steps, which we may call i) feeding the state to the chain 
by Alice, ii) passing the state by controllers, and iii) retrieval of the state by the receiver. These 
three steps are shown respectively in figures (jSJ), © and (jSJ). 

Alice first follows the steps of the previous section and teleports the state \x) to the left 
hand side of the chain, that is to B\ and B 2 . This is shown in figure Once fed into the 
chain, the controller Bi can proceed along the same procedure and teleport his share of the 
state to B3. Now the state is shared between B 2 and B%. Upon continuing this process, the 
state is transferred one by one along the chain, until at the end it reaches the controller B^-i 
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and the receiver B^. A typical intermediate step is shown in figure (ITj). In each step note that 
the basic rule of transformation of the diagram is the one displayed in figure ([3]). 

The operator which will recover the original state is Qi = Z H X 31 ® Z %2 X^ 2 . In the next 
step, the controller B 2 will teleport his share to the the next nearest member B4, which will 
cause the state to be shared between B 3 and i? 4 . This process continues to the end, until the 
state reaches the last controller B^_i and the receiver B^. At each step say the k — th step, 
when the controller Bk makes a Bell measurement with the result (m^, n^), the state in transfer 
gains an extra correction operator 

U k = (J <g> Z mk X nk ), 

leading to the recovery operator 

^fe+i — Uk+i^k- 

Therefore when the state reaches the last controller B^_ 2 it has gained the unitary operator 
(figure [8]). His measurement will pass the state entirely to the receiver B N , figure ([8]) 
with a further correction Qn-i- The receiver can now retrieve the state by the action of the 
correction operator 

R = Qjv-i = {Z h X jl <g> Z i2 X j2 ){I ® z mi+m2+ - mN - i x ni+n2+ - nN - 1 ). (10) 

The correction operator depends on the four bits (ii,i2,ji,j2) announced by Alice and the 
2(N — 2) bits (mi, rii] TU2i n 2', • • • ttin-i, n^-i) announced by the controllers. 

After this step, if one of them makes a measurement on his own qubits; he passes his qubit's 
context to his next neighbor. If all of the members keep on this algorithm and exchange their 
information with each other, figure El and finally the receiver can regenerate the initial state 
only with acting an appropriate operator. However non of the controllers can extract all the 
information; because each of them in each step has one part of the state Xi so their density 
matrices are in the mixed state. It is clear that in the last step, the pattern of passing is the 
same as two parties scheme completely, figure HI 



4 Changing the receiver 

At first sight it appears that the pattern of Bell pair sharing shown in figure (jSJ) already fixes 
who is to be the receiver of the state among the members of the group, and therefore Alice as 
the sender of the state has no choice in demanding that a different member of the group be 
the final receiver of the state. However this pattern can easily be changed to other desirable 
patterns by simple entanglement swapping. Therefore if we change the order of measurements 
of the members of the group, we can choose anyone of the members to act as the receiver and 
the other ones as controllers. This exchange which is achieved by a sequence of entanglement 
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swapping, can be demanded before or after step one, namely the feeding of the state into 
the chain. The explicit process is that Alice announces the order of measurements that the 
members of the group have to perform. In the process of these measurements, the identity of 
the members as controllers or the receiver will be established. 

5 Security against cheating 

How this protocol is protected against cheating of probable dishonest members? If we look 
at figure (171), we note hat any two consecutive members of the group, say Bk+i and Bk+2 in 
that figure, may conspire to retrieve the state by their own, hence cutting off the transfer of 
state down the chain. To do this, they need to share another independent Bell pair between 
themselves and then use the protocol described in section (3) to teleport the state to only one 
of them say Bk+2- In this way and by their own collaboration they can definitely retrieve the 
state Qk+iX which otherwise, could have been transferred down the chain. In this way they 
have effectively been able to cut the flow of state by cutting off the chain. However in order 
to retrieve the original state \x), they need to know the operator Q which depends on all the 
results of previous controllers and also that of Alice. Therefore Alice can defer announcement of 
her results and also demands that all the controllers announce the results of their measurements 
only after the state has passed through all the chain. One may argue that the two dishonest 
parties, can proceed as described above, keep the state flk+iX an d send a fake qubit down the 
line and then wait until all announcements are made, and then recover the true state. This 
possibility is not ruled out, although it requires that the two dishonest members be located in 
adjacent positions of the chain which has after all a low probability. However, by comparing a 
random subset of the received state with the ones sent by Alice, she and the legitimate receiver 
can easily detect whether or not if there are dishonest members in the group. Furthermore 
by entanglement swapping a few times and hence changing the receiver and the controllers 
randomly, she can not only decrease the role of any cheating, but she can also detect exactly 
the location of dishonest members. 




Figure 7: Step two: Passing of the state along the chain. The controllers pass the state one to 
the other. Here the controllers (Bk,Bk+i) pass the state to (Bk+i, Bk+2)- For this Bk makes a 
Bell-measurement, shown with the dotted box, with the random result m^n^, leaving his two 
qubits in a state mfc , nfe , and teleporting his share to Bk+2- 
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Figure 8: Step three, the final step of the protocol. The final controller passes the unknown state x 
to the receiver who retrieve it with the operator R, determined by the code announced by Alice and 
all the controllers. 
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Figure 9: The exchange of the receiver and any of the controllers can be achieved by entangle- 
ment swapping. Here Bk+i and Bk+2 exchange their role, B^+2 becomes a controller and B^+i 
becomes the receiver. By a sequence of entanglement swapping demanded by Alice, any change 
of pattern can be induced. 



6 A comparative account of necessary resources 

In this section we make a comparison between the resources necessary for our protocol with that 
of ([5J). Consider the two-qubit state sharing scheme of [B] with members ( 1 receiver and 
N-l controllers). Figure (|2D, shows the necessary resources. It requires 2N Bell pairs and two 
measurements by Alice in the N + 1 qubit GHZ basis. Furthermore to announce the results of 
Alice's measurements, she needs to announce 2(A^+ 1) classical bits and the controllers require 
to announce in total 2(A^ — 1) bits. 

In contrast, as explained in the text and figures (0 [6j), our scheme requires, for the same 
number of members, the following resources: First it requires A^ + 1 Bell pairs. Furthermore 
it requires no measurement in the GHZ basis. Alice and the controllers require to announce 
2(N + 1) classical bits. Table (jBJ) summarizes this comparison. 
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The scheme of [6J 



our scheme 



Number of Bell pairs 
GHZ measurements 
Number of classical bits announced by Alice 
Number of classical bits announced by the controllers 



2N 
2 

2(N+1) 
2(N-1) 



2(N-1) 



N+l 

4 



Table 1: Comparison of the resources necessary for two-qubit state sharing between N members. 

7 conclusion 

In this article, we have introduced a more efficient and secure protocol for quantum state 
sharing of a two-qubit state between a group of N members. All the members of the group and 
the sender should collaborate with each other so that only one member called the receiver can 
retrieve the state after receiving classical bits from the sender and the controllers. The basic 
ingredient of the scheme is what we call Passing, where the state is passed through a chain of 
Bell pairs hold by the controllers, none of whom can detect the identity of the state, but whose 
collaboration is necessary for the final retrieval of the state by the final receiver. Passing of the 
state along the chain is achieved by a sequence of entanglement swapping. We also discuss the 
security of the protocol against cheating of the members of the group and make a comparison 
of the resources necessary for this state sharing with the one given in [Bj, which is summarized 
in table [6j We hope that the basic idea of state- passing introduced in this paper can find more 
applications in other applications and can be implemented in real experiments. 
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